Data Sharing API

The Data Sharing API allows you to inform Orchestrate Server when members have chosen to allow Orchestrate to share their data with other entities. For example, it can be used to share the member’s opt-in or opt-out preference in the Provider Access API.

Authentication

The request must include an access token obtained using backend services authorization. The payer will have received a client id during the installation process that can be used for authentication.

The scopes to request are:

Sharing Types

When updating sharing status, you specify an entity type of Provider or Payer. When a member has opted out of data sharing, Orchestrate will not respond to requests for that member’s data from any entity of the specified type.

CMS-0057-F Compliance

The following guidance will help you ensure compliance with the CMS Interoperability and Prior Authorization Final Rule.

For the Provider Access API

Under CMS-0057-F, members are assumed to be opted in to data sharing unless they request to be opted out. If your state and/or organization has stricter requirements, you must issue Provider opt-out notifications for each member.

For the Payer-to-Payer API

Allowing Payer response opt-outs is not permitted under CMS-0057-F, and may cause regulatory non-compliance. Previous payers are obligated to respond to data requests containing valid attestations from other payers.

The data sharing status does not apply to the Payer to Payer Bulk Import, since Orchestrate is making the request, not responding to it. The presence of the member with the required consent information in the trigger file is taken as evidence that they have consented to the data transfer.

Set Data Sharing Status

To set a member’s data sharing status, use the FHIR $set-data-sharing operation on the Patient resource.

Endpoint

POST [base endpoint]/Patient/$set-data-sharing

Input

The request body data is a FHIR Parameters resource with the following fields:

Output

If successful, the response will contain information about the current opt-outs. Opt-ins are not reported, since opting in is the default. The response data is a FHIR Parameters resource with the following fields:

If there are errors, the operation will return a Bad Request (400) HTTP status code with a FHIR OperationOutcome as the response data.

Example

{
  "resourceType" : "Parameters",
  "parameter" : [
    {
      "name" : "member",
      "valueString" : "1112223330"
    },
    {
      "name" : "opt-out",
      "valueCode" : "Provider"
    },
    {
      "name" : "opt-in",
      "valueCode" : "Payer"
    }
  ]
}

{
  "resourceType" : "Parameters",
  "parameter" : [
    {
      "name" : "member",
      "valueString" : "1112223330"
    },
    {
      "name" : "opt-out",
      "valueCode" : "Provider"
    }
  ]
}

Get Data Sharing Status

To get a member’s data sharing status, use the FHIR $get-data-sharing operation on the Patient resource.

Endpoint

GET [base endpoint]/Patient/$get-data-sharing

Input

The only input is the member query parameter. For example: GET [base endpoint]/Patient/$get-data-sharing?member=1112223330

Output

If successful, the response will contain information about the current opt-outs. Opt-ins are not reported, since opting in is the default. The response data is a FHIR Parameters resource with the following fields:

If there are errors, the operation will return a Bad Request (400) HTTP status code with a FHIR OperationOutcome as the response data.

Example

{
  "resourceType" : "Parameters",
  "parameter" : [
    {
      "name" : "opt-out",
      "valueCode" : "Provider"
    }
  ]
}

{
  "resourceType" : "Parameters"
}